Phishing kits are fake login pages for banks, email providers or delivery companies, uploaded by attackers to a hacked website so the link looks trustworthy. If Imunify360 flags one in your account, act quickly: phishing pages get domains blacklisted within hours.
Before you start
- cPanel access.
- The detection details from cPanel → Security → Imunify360: file paths and detection names.
Signs of a phishing kit
- Folders with bank, email or courier names inside
public_htmlorwp-content, such as/secure-login/or/office365/. - ZIP archives you did not upload.
- PHP files that send form data by email or to Telegram.
Remove it
- Let Imunify360 clean or remove the detected files (see cleaning infected files).
- Delete the whole phishing folder and any ZIP files that belong to it, using File Manager.
- Run a full scan to find other malicious files (see scanning).
Find how it got in
- Compromised cPanel or FTP password: check cPanel → Metrics → Raw Access and FTP logs around the upload time.
- Vulnerable plugin or theme: look for outdated plugins, especially file managers and form plugins.
- Unknown WordPress admin users created by the attacker.
Secure the account
- Change cPanel, FTP, email and CMS admin passwords; enable 2FA.
- Update or remove vulnerable software.
- Delete unknown users and FTP accounts.
Warning: Phishing pages often steal visitors' passwords and send them by email. Check that no mail forwarders or scripts in your account send data to unknown addresses, and remove them.
Blacklists and warnings
If browsers show a "Deceptive site" warning or Google Search Console reports phishing, request a review after cleaning (see reputation management). Hosting providers and brand owners may also send abuse reports; reply that the content is removed.
For resellers
MdmHost may suspend an account hosting phishing to protect the server; see accounts suspended by the host. Clean up, then reply to the ticket.
Frequently asked questions
Is my own data at risk?
Phishing kits target visitors, not your site's data, but the attacker had access to your account. Treat it as a full compromise and secure everything.
Why was my domain used?
Attackers use any hacked site; a trusted, established domain makes the phishing link look more credible.
How do I prevent it?
Keep software updated, use unique passwords and 2FA, and remove unused plugins (see the security checklist for customers).
Should I restore a backup instead?
If the account is heavily infected, restoring files from before the upload is often faster. Then secure the entry point before going live again.
Do I need to tell anyone?
If visitors may have entered data, the brand being imitated may contact you; cooperate and confirm removal. Your own customers' data was not the target.
How long until warnings disappear?
After a successful review, browser warnings usually clear within a day or two.
Can Imunify360 stop phishing uploads?
Real-time scanning removes known phishing kits on upload, which is why you saw the detection. Closing the entry point stops new uploads.